Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 37b6f259 authored by Wei Jia's avatar Wei Jia
Browse files

MediaPlayer: fix use after free for mMediaTimeProvider 

Test: cts
Bug: 128327073
Change-Id: I4c9a9e3bfe27d6ec3d533a4ef8c5706d32221eed
parent f3d07377

media/java/android/media/MediaPlayer.java

+4 −3
Original line number Diff line number Diff line
@@ -2645,7 +2645,7 @@ public class MediaPlayer extends PlayerBase 
     */

    private synchronized void setSubtitleAnchor() {

        if ((mSubtitleController == null) && (ActivityThread.currentApplication() != null)) {

            getMediaTimeProvider();

            final TimeProvider timeProvider = (TimeProvider) getMediaTimeProvider();

            final HandlerThread thread = new HandlerThread("SetSubtitleAnchorThread");

            thread.start();

            Handler handler = new Handler(thread.getLooper());
@@ -2653,7 +2653,8 @@ public class MediaPlayer extends PlayerBase 
                @Override

                public void run() {

                    Context context = ActivityThread.currentApplication();

                    mSubtitleController = new SubtitleController(context, mTimeProvider, MediaPlayer.this);

                    mSubtitleController =

                            new SubtitleController(context, timeProvider, MediaPlayer.this);

                    mSubtitleController.setAnchor(new Anchor() {

                        @Override

                        public void setSubtitleWidget(RenderingWidget subtitleWidget) {
@@ -2661,7 +2662,7 @@ public class MediaPlayer extends PlayerBase 


                        @Override

                        public Looper getSubtitleLooper() {

                            return mTimeProvider.mEventHandler.getLooper();

                            return timeProvider.mEventHandler.getLooper();

                        }

                    });

                    thread.getLooper().quitSafely();

media/java/android/media/SubtitleTrack.java

+3 −1
Original line number Diff line number Diff line
@@ -263,8 +263,10 @@ public abstract class SubtitleTrack implements MediaTimeProvider.OnMediaTimeList 
        }

        updateView(mActiveCues);

        mNextScheduledTimeMs = -1;

        if (mTimeProvider != null) {

            mTimeProvider.notifyAt(MediaTimeProvider.NO_TIME, this);

        }

    }



    /** @hide */

    protected MediaTimeProvider mTimeProvider;